Aube vs Rush

Aube is an open-source Node.js package manager written in Rust for Linux, macOS, and Windows. Its aubr command checks dependencies before running a project script and installs those that are missing or stale. Aube reads and writes supported pnpm, npm, Yarn, and Bun lockfiles, while its content-addressable store shares package directory trees across projects and worktrees. For one-off tools, aubx uses a local binary when available or installs the tool in a throwaway project. Workspaces, filters, and catalogs can be configured through pnpm-workspace.yaml or aube-workspace.yaml, and commands can use a project-pinned Node version. Security checks consider publishing evidence, release age, and known malicious packages during version selection. Dependency lifecycle scripts need project approval or built-in trust, with explicit denials taking precedence. Optional integrity verification checks fetched registry tarballs against recorded values. Installation options include mise, Homebrew, npm, Cargo, distribution packages, and source builds. Aube also provides embedding integrations for Rust, Node-API hosts, and C ABI consumers, plus a GitHub Action. Yarn Plug'n'Play projects are not supported and require a node_modules linker.

Rush is a monorepo manager for JavaScript developers who build and publish many packages from a shared Git repository. It can install dependencies, link projects, build, generate change logs, update versions, and publish packages to an npm registry. Build modes include parallel, subset, incremental, and distributed builds. Rush puts dependencies in a common folder and uses symlinks to recreate a node_modules folder for each project. Its installation algorithm supports PNPM, NPM, and Yarn. For releases, it gathers change files and updates package versions and changelogs before publishing. Project folders remain self-contained: they can be built without Rush or moved to a separate repository without code changes. Rush runs on Linux, macOS, and Windows; its getting-started demo lists NodeJS as the only prerequisite. Plugins can share configuration and extend features, but the plugin framework is marked experimental. Microsoft does not provide official support; community help is directed to GitHub issues and Rush Stack Zulip. Rush is free and open source.